FileVault protects the data on a Mac’s startup disk and requires an authorised login before someone can access it. On a Mac with Apple silicon or a T2 Security Chip, data is already encrypted automatically; turning on FileVault adds the login requirement and a recovery choice. Record that choice before you depend on it.
Apple’s current Australian FileVault guide offers two recovery routes: use the Apple Account connected to iCloud, or create a separate recovery key. The right choice depends on which account or key you can keep secure and available if the Mac password is forgotten.
What FileVault changes
FileVault protects the startup disk at rest. A person cannot simply remove the storage or start the Mac another way and read the files without the authorised login or recovery method.
On a Mac with Apple silicon or a T2 Security Chip, Apple says the data is already encrypted automatically. FileVault still adds protection by requiring login credentials before the data can be decrypted and accessed. Older Macs without those chips need FileVault turned on for disk encryption.
FileVault does not protect an unlocked Mac from someone already using the signed-in account. It also does not replace backups. If the Mac or its internal storage fails, encryption cannot recover a file that exists in only one place.
Before you turn it on
Check these points first:
- Make a current backup and confirm you can find at least one important file in it.
- Confirm you know the Mac administrator password.
- Decide whether recovery will use iCloud or a separate key.
- If the Mac has several users, identify who must be able to unlock the disk.
- Keep the Mac connected to power during setup.
A local backup with Time Machine gives you a separate recovery route for files. FileVault and a backup solve different problems: one restricts access, while the other helps restore data.
Turn on FileVault
Apple’s current steps are:
- Open the Apple menu and choose System Settings.
- Select Privacy & Security in the sidebar.
- Scroll to FileVault.
- Select Turn On.
- Enter the administrator password if asked.
- Choose the recovery method.
- Select Continue.
The labels can differ on earlier macOS versions, but FileVault remains under Security or Privacy & Security settings. Apple’s online guide includes a version selector, so match the page to the version installed on the Mac.
Choose iCloud recovery or a recovery key
The iCloud option lets the Apple Account associated with iCloud help unlock the disk or reset the login password. This is convenient if that account is well protected and its sign-in information is available away from the Mac.
The separate recovery-key option creates a string of letters and numbers. Apple tells users to write it down exactly and keep it somewhere safe, away from the encrypted startup disk. A copy stored only in a file on the same Mac is not a useful recovery plan.
Consider the trade-off:
| Recovery choice | Useful when | Main risk to manage |
|---|---|---|
| Apple Account and iCloud | You maintain access to the account and its trusted devices | Losing the account, trusted number or recovery access |
| Separate recovery key | You want recovery independent of iCloud | Misplacing the key or storing it beside the Mac |
Do not paste a FileVault recovery key into an ordinary note, chat or email. If you use a password manager, confirm how its emergency access and account recovery work before treating it as the only copy.
Keep the recovery key away from the Mac
Apple is explicit about the consequence of losing all recovery paths: if the login password cannot be reset and the recovery key is also unavailable, the files and settings can be lost permanently.
A practical storage plan might include:
- one accurate paper copy in a secure location away from the Mac;
- one protected digital copy in an account with its own recovery plan;
- a note identifying which Mac the key belongs to, without placing the key on the device itself.
Do not photograph the key and leave the photo in the Mac’s local Photos library. That again puts the recovery information on the encrypted disk it is meant to unlock.
If the Mac belongs to a business or school, the organisation may hold an institutional recovery key. Ask the administrator which recovery route applies before changing the setting.
FileVault with multiple users
Apple says all user information is encrypted. Each person who needs to unlock the startup disk must be enabled for FileVault.
If System Settings shows Enable Users, an administrator must select the user and enter that user’s login password. A user who is not enabled may be unable to unlock the disk at startup even if the account works after another authorised user signs in.
Review this after adding a new person to a shared Mac. The account list and the FileVault unlock list are related, but they are not always identical.
What to check after setup
Restart the Mac and confirm an authorised user can reach the login screen and sign in. Then verify that the backup still runs.
Also record:
- the selected recovery method;
- where the recovery information is stored;
- which users can unlock the disk;
- the date you last confirmed the backup.
Do not test a recovery key by deliberately locking yourself out of the only administrator account. The safer check is to verify the saved key’s characters against the original during setup and keep a current backup.
Before selling or giving away the Mac
FileVault is not a substitute for Apple’s erase process. Back up what you need, sign out of services, and erase the Mac using the supported steps for its macOS version. ULKA’s guide to wiping a laptop before selling it covers the handover checks.
